You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by GitBox <gi...@apache.org> on 2021/11/10 23:21:14 UTC
[GitHub] [kafka] kirktrue opened a new pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation
kirktrue opened a new pull request #11487:
URL: https://github.com/apache/kafka/pull/11487
The tests for OAuth JWT validation all assume usage of RSA, but we need to have ECDSA support there too.
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] junrao merged pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation
Posted by GitBox <gi...@apache.org>.
junrao merged pull request #11487:
URL: https://github.com/apache/kafka/pull/11487
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] junrao commented on a change in pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation
Posted by GitBox <gi...@apache.org>.
junrao commented on a change in pull request #11487:
URL: https://github.com/apache/kafka/pull/11487#discussion_r749554644
##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/AccessTokenBuilder.java
##########
@@ -49,22 +49,24 @@
private Long expirationSeconds;
- private RsaJsonWebKey jwk;
+ private PublicJsonWebKey jwk;
- public AccessTokenBuilder() throws JoseException {
+ public AccessTokenBuilder() {
this(new MockTime());
}
- public AccessTokenBuilder(Time time) throws JoseException {
+ public AccessTokenBuilder(Time time) {
this.issuedAtSeconds = time.milliseconds() / 1000;
this.expirationSeconds = this.issuedAtSeconds + 60;
- this.jwk = createJwk();
}
- public static RsaJsonWebKey createJwk() throws JoseException {
- RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048);
- jwk.setKeyId("key-1");
- return jwk;
+ public String alg() {
+ return alg;
+ }
+
+ public AccessTokenBuilder alg(String alg) {
Review comment:
While you are at this, a few other methods like audience() and subjectClaimName seem never used. Is that expected?
##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/ValidatorAccessTokenValidatorTest.java
##########
@@ -38,14 +40,35 @@ protected AccessTokenValidator createAccessTokenValidator(AccessTokenBuilder bui
}
@Test
- public void testBasicEncryption() throws Exception {
- AccessTokenBuilder builder = new AccessTokenBuilder();
+ public void testRsaEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createRsaJwk();
+ testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.RSA_USING_SHA256);
+ }
+
+ @Test
+ public void testEcdsaEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createEcJwk();
+ testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
+ }
+
+ @Test
+ public void testInvalidEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createRsaJwk();
+
+ assertThrowsWithMessage(InvalidAlgorithmException.class,
+ () -> testEncryptionAlgorithm(jwk, "fake"),
+ "fake is an unknown, unsupported or unavailable alg algorithm");
+ }
+
+ private void testEncryptionAlgorithm(PublicJsonWebKey jwk, String alg) throws Exception {
+ AccessTokenBuilder builder = new AccessTokenBuilder().jwk(jwk).alg(alg);
AccessTokenValidator validator = createAccessTokenValidator(builder);
JsonWebSignature jws = new JsonWebSignature();
jws.setKey(builder.jwk().getPrivateKey());
jws.setKeyIdHeaderValue(builder.jwk().getKeyId());
- jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
+ jws.setAlgorithmHeaderValue(alg);
+ jws.setPayload("{}");
Review comment:
Hmm, how is jws being used?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] kirktrue commented on a change in pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation
Posted by GitBox <gi...@apache.org>.
kirktrue commented on a change in pull request #11487:
URL: https://github.com/apache/kafka/pull/11487#discussion_r749721422
##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/AccessTokenBuilder.java
##########
@@ -49,22 +49,24 @@
private Long expirationSeconds;
- private RsaJsonWebKey jwk;
+ private PublicJsonWebKey jwk;
- public AccessTokenBuilder() throws JoseException {
+ public AccessTokenBuilder() {
this(new MockTime());
}
- public AccessTokenBuilder(Time time) throws JoseException {
+ public AccessTokenBuilder(Time time) {
this.issuedAtSeconds = time.milliseconds() / 1000;
this.expirationSeconds = this.issuedAtSeconds + 60;
- this.jwk = createJwk();
}
- public static RsaJsonWebKey createJwk() throws JoseException {
- RsaJsonWebKey jwk = RsaJwkGenerator.generateJwk(2048);
- jwk.setKeyId("key-1");
- return jwk;
+ public String alg() {
+ return alg;
+ }
+
+ public AccessTokenBuilder alg(String alg) {
Review comment:
They're there for completeness. I've removed them now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] kirktrue commented on a change in pull request #11487: KAFKA-13445: Add ECDSA test for JWT validation
Posted by GitBox <gi...@apache.org>.
kirktrue commented on a change in pull request #11487:
URL: https://github.com/apache/kafka/pull/11487#discussion_r749721059
##########
File path: clients/src/test/java/org/apache/kafka/common/security/oauthbearer/secured/ValidatorAccessTokenValidatorTest.java
##########
@@ -38,14 +40,35 @@ protected AccessTokenValidator createAccessTokenValidator(AccessTokenBuilder bui
}
@Test
- public void testBasicEncryption() throws Exception {
- AccessTokenBuilder builder = new AccessTokenBuilder();
+ public void testRsaEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createRsaJwk();
+ testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.RSA_USING_SHA256);
+ }
+
+ @Test
+ public void testEcdsaEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createEcJwk();
+ testEncryptionAlgorithm(jwk, AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
+ }
+
+ @Test
+ public void testInvalidEncryptionAlgorithm() throws Exception {
+ PublicJsonWebKey jwk = createRsaJwk();
+
+ assertThrowsWithMessage(InvalidAlgorithmException.class,
+ () -> testEncryptionAlgorithm(jwk, "fake"),
+ "fake is an unknown, unsupported or unavailable alg algorithm");
+ }
+
+ private void testEncryptionAlgorithm(PublicJsonWebKey jwk, String alg) throws Exception {
+ AccessTokenBuilder builder = new AccessTokenBuilder().jwk(jwk).alg(alg);
AccessTokenValidator validator = createAccessTokenValidator(builder);
JsonWebSignature jws = new JsonWebSignature();
jws.setKey(builder.jwk().getPrivateKey());
jws.setKeyIdHeaderValue(builder.jwk().getKeyId());
- jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
+ jws.setAlgorithmHeaderValue(alg);
+ jws.setPayload("{}");
Review comment:
It isn't. I've removed it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org